Posted
by
timothy
on Tuesday February 26, 2013 @08:45AM
from the nice-binary-number dept.

chicksdaddy writes "The security firm Bit9 released a more detailed analysis of the hack of its corporate network was part of a larger operation that was aimed a firms in a 'very narrow market space' and intended to gather information from the firms. The analysis, posted on Monday on Bit9's blog is the most detailed to date of a hack that was first reported on February 8 by the blog Krebsonsecurity.com, but that began in July, 2012. In the analysis, by Bit9 Chief Technology Officer Harry Sverdlove said 32 separate malware files and malicious scripts were whitelisted in the hack. Bit9 declined to name the three customers affected by the breach, or the industry segment that was targeted, but denied that it was a government agency or a provider of critical infrastructure such as energy, utilities or banking. The small list of targets — just three — and the fact that one malware program was communicating with a system involved in a recent 'sinkholing operation' raises the specter that the hack of Bit9 may have played a part in the recent attacks on Facebook, Twitter and Apple, though Bit9 declined to name the firms or the market they serve."

Yes, Bit9 software is a default deny paradigm, and so anything that is allowed to run on your system needs to be explicitly allowed, so malware can't get onto your system so easily (buffer overflows are still possible). That being said, Bit9 did not protect one of their all important signing keys, so the hacker used it and signed a whole lot of bad stuff they had in their tool bag. The hacker thereby added all his malware to the permitted white-list because they were signed by an authority that is trusted by the software protecting the systems. Who could be more trusted than the software company who protects your computer?

I don't see these methods as being as effective as profiling programs based on their behavior and then negating them by dangerous behaviors, not by prior encounter.

Lists are too easily subverted, not only by hacks like this, but by misidentification and other errors. As someone who recently had to re-send a large number of emails because an "anti-spam" agency mistakenly categorized my mailhost as a spam attacker, I find the many false categorizations to be as damaging as the original fear.

I don't see these methods as being as effective as profiling programs based on their behavior and then negating them by dangerous behaviors, not by prior encounter.

Lists are too easily subverted, not only by hacks like this, but by misidentification and other errors. As someone who recently had to re-send a large number of emails because an "anti-spam" agency mistakenly categorized my mailhost as a spam attacker, I find the many false categorizations to be as damaging as the original fear.

Normally it is just the signed binaries that are permitted to run on the system, but an organization can add rules that permit unsigned code to run in certain circumstances. In that sense there is no published white-list, only cryptographic data that is being validated. To fix the problem Bit9 merely had to revoke a single signing key, but then all kinds of programs would stop running all at once. I have not heard yet what else exactly had been signed by that same key.

I don't see these methods as being as effective as profiling programs based on their behavior and then negating them by dangerous behaviors, not by prior encounter.

On systems where it is known what they should be doing, a lot of corporate desktops for example, whitelisting just those things required is far more effective: there's no need to try to figure out what is actually dangerous. It's following the principle that it is far easier to enumerate good behaviors than bad ones. Yes, that doesn't cover everything for all users but then it isn't a tool for everyone. On systems where it is applicable, it's a very good security measure.

Wait a second. You mean that despite this company's security and operational protocols and supposed firewalls, they found that they had a server compromised by a SQL injection in 2012, took it offline, and then BROUGHT IT BACK ONLINE in 2013 w/o wiping it???

OR

They had a SQL injection on a server in 2012, never saw it but turned off the system anyway, and then brought the SAME system back up in 2013?

The sad side effect of endless war, warrantless wiretapping, blatant disregard of the Rule of Law, is that I'm left to wonder if any of this is true, instead of just a False Flag operation to justify the final destruction of privacy and the true Internet.

The sad side effect of endless war, warrantless wiretapping, blatant disregard of the Rule of Law, is that I'm left to wonder if any of this is true, instead of just a False Flag operation to justify the final destruction of privacy and the true Internet.